| Package | Affected versions | Patched versions |
|---|---|---|
| owncloud | ≤ 4.0.8 | |
| owncloud server | = 3.0.0= 3.0.1= 3.0.2= 3.0.3= 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7= 4.5.0 |
The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free